CVE-2023-7203

MEDIUM

Smart Forms < 2.6.87 - Cross-Site Request Forgery and Unauthorized Action Execution via AJAX Actions

Title source: llm
STIX 2.1

Description

The Smart Forms WordPress plugin before 2.6.87 does not have authorisation in various AJAX actions, which could allow users with a role as low as subscriber to call them and perform unauthorised actions such as deleting entries. The plugin also lacks CSRF checks in some places which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as deleting entries.

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/b514b631-c3e3-4793-ab5d-35ed0c38b011/

Scores

CVSS v3 6.1
EPSS 0.0022
EPSS Percentile 12.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
rednao/smart_forms < 2.6.87
Published Feb 27, 2024
Tracked Since Feb 18, 2026